malware

WarzoneRAT S0670

Type: malware
Platform: Windows
Created: 27 December 2021
Last modified: 3 October 2023

WarzoneRAT is a malware-as-a-service remote access tool (RAT) written in C++ that has been publicly available for purchase since at least late 2018.[1][2]

TechniquesTop 8%

TacticsTop 1%

Threat groupsunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S0670

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
	Detects file access requests to files ending with either the ".hive"/".reg" extension, usually associated with Windows Registry backups.	Hunting	test	file_access	windows	-	Persistence, Defense Impairment Modify Registry	-	low	frack113	2023-09-15	2024-07-29	337a31c6-46c4-46be-886a-260d7aa78cac
	Detects file access requests to browser credential stores by uncommon processes. (...)	Hunting	test	file_event	windows	WinEventLog Security	Credential Access Credentials from Password Stores Credentials from Web Browsers	-	low	Daniel Koifman (@Koifsec), Nasreddine Bencherchali	2024-10-21	—	4b60e527-ec73-4b47-8cb3-f02ad927ca65
	Adversaries may acquire credentials from web browsers by reading files specific to the target browser. (...)	Generic	test	ps_script	windows	PowerShell	Credential Access Credentials from Password Stores Credentials from Web Browsers	-	medium	frack113	2022-01-30	—	fc028194-969d-4122-8abe-0470d5b8f12f
	Detect set Notification_Suppress to 1 to disable the Windows security center notification	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	medium	frack113	2022-08-19	2023-08-17	0c93308a-3f1b-40a9-b649-57ea1a1c1d63
	Detect set DisallowRun to 1 to prevent user running specific computer program	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	medium	frack113	2022-08-19	2023-08-17	275641a5-a492-45e2-a817-7c81e9d9d3e9
Splunk	The following analytic detects the use of commands to add or set exclusions in Windows Defender. It (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Defense Impairment Disable or Modify Tools	-	medium	Teoderick Contreras, Nasreddine Bencherchali, Splunk	2021-11-25	2026-06-08	773b66fe-4dd9-11ec-8289-acde48001122
	Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-09-02	2024-03-19	d7662ff6-9e97-4596-a61d-9839e32dee8d
	Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). (...)	Generic	test	pipe_created	windows	Sysmon	Collection Data from Local System	-	medium	Roberto Rodriguez @Cyb3rWard0g	2021-10-08	2023-11-30	1ea13e8c-03ea-409b-877d-ce5c3d2c1cb3
Splunk	The following analytic detects suspicious modifications to firewall rule registry settings that allow inbound traffic on specific ports with a public profile. (...)	Generic	stable	registry_event	windows	Sysmon	Lateral Movement Remote Services Remote Desktop Protocol	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-05-26	2026-05-13	0a46537c-be02-11eb-92ca-acde48001122
Splunk	The following analytic detects a suspicious PowerShell command that allows inbound traffic to a specific local port within the public profile. (...)	Generic	stable	ps_script	windows	PowerShell	Lateral Movement Remote Services Remote Desktop Protocol	-	medium	Teoderick Contreras, Splunk	2021-05-19	2026-05-13	a5d85486-b89c-11eb-8267-acde48001122
	Detect enable rdp feature to allow specific user to rdp connect on the targeted machine	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	medium	frack113	2022-08-19	2023-08-17	37b437cf-3fc5-4c8e-9c94-1d7c9aff842b
	Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe	Generic	test	ps_module	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	medium	Roberto Rodriguez @Cyb3rWard0g	2019-08-11	2025-10-17	64e8e417-c19a-475a-8d19-98ea705394cc
	Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe	Generic	test	pipe_created	windows	Sysmon	Execution Command and Scripting Interpreter PowerShell	-	medium	Roberto Rodriguez @Cyb3rWard0g, Tim Shelton	2019-09-12	2025-10-07	58cb02d5-78ce-4692-b3e1-dce850aae41a
	Detects Windows Installer service (msiexec.exe) spawning "cmd" or "powershell"	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	medium	Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community	2020-10-13	2022-10-20	1e53dd56-8d83-4eb4-a43e-b790a05510aa
	This rule will looks any process with low privilege launching Windows Installer service (msiexec.exe (...)	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	high	Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community	2020-10-13	—	078235c5-6ec5-48e7-94b2-f8b5474379ea
	Detects Windows Installer service (msiexec.exe) trying to install MSI packages with SYSTEM privilege	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	medium	Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community	2020-10-13	2024-12-01	cd951fdc-4b2f-47f5-ba99-a33bf61e3770
	Detects code fragments found in small and obfuscated AMSI bypass PowerShell scripts	Generic	test	ps_script	windows	PowerShell	Defense Impairment Disable or Modify Tools	-	high	Florian Roth (Nextron Systems)	2022-11-09	—	e0d6c087-2d1c-47fd-8799-3904103c5a98
	Detects attempts to disable AMSI (Anti-Malware Scan Interface) by modifying the AmsiEnable registry value. (...)	Generic	experimental	registry_set	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-12-25	—	aa37cbb0-da36-42cb-a90f-fdf216fc7467
	Detects activity that indicates a user disabling the ability for Antivirus mini filter to inspect a "Dev Drive".	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools	-	high	@kostastsale, Nasreddine Bencherchali (Nextron Systems)	2023-11-05	2024-08-16	31e124fb-5dc4-42a0-83b3-44a69c77b271
	Detects the suspicious file that is created from PoC code against Windows Print Spooler Remote Code Execution Vulnerability CVE-2021-34527 (PrinterNightmare), CVE-2021-1675 .	Emerging	stable	antivirus	-	-	Privilege Escalation, Stealth Process Injection	CVE-2021-1675 CVE-2021-34527	critical	Sittikorn S, Nuttakorn T, Tim Shelton	2021-07-01	2023-10-23	6fe1719e-ecdf-4caf-bffe-4f501cb0a561
	Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.	Generic	experimental	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	heyyanu	2026-03-26	—	557e3bd3-7f21-495d-8d50-7c8bdfb8041c
	Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.	Generic	test	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	Pushkarev Dmitry	2020-06-28	2025-12-03	401e5d00-b944-11ea-8f9a-00163ecd60ae
	Detects DNS queries made by "AppInstaller.EXE". (...)	Generic	test	dns	windows	Sysmon	Command and Control Ingress Tool Transfer	-	medium	frack113	2021-11-24	2023-11-09	7cff77e1-9663-46a3-8260-17f2e1aa9d0a
	Detects an image load pattern as seen when a tool named PRIVATELOG is used and rarely observed under (...)	Emerging	test	image_load	windows	Sysmon	Privilege Escalation, Stealth Process Injection	-	high	Florian Roth (Nextron Systems)	2021-09-07	2022-10-09	33a2d1dd-f3b0-40bd-8baf-7974468927cc
	Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Ingress Tool Transfer	-	medium	Victor Sergeev, oscd.community	2020-10-09	2023-10-18	eee00933-a761-4cd0-be70-c42fe91731e7
	The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Initial Access Phishing Spearphishing Attachment Execution User Execution	-	medium	Sreeman	2020-03-13	2022-04-14	24de4f3b-804c-4165-b442-5a06a2302c7e
	Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including: - Use (...)	Generic	experimental	process_creation	linux	Linux Auditd	Defense Impairment Disable or Modify Tools Privilege Escalation, Stealth Process Injection Proc Memory	-	high	Milad Cheraghi	2025-05-26	2025-12-05	e497a24e-9345-4a62-9803-b06d7d7cb132
	Detect changes in auditd configuration files	Generic	test	file_event	linux	Linux Auditd	Defense Impairment Disable or Modify Tools	-	high	Mikhail Larin, oscd.community	2019-10-25	2021-11-27	977ef627-4539-4875-adf4-ed8f780c4922
	Detects automated lateral movement by Turla group	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Discovery File and Directory Discovery Discovery Network Share Discovery Lateral Movement Remote Services SMB/Windows Admin Shares	-	medium	Markus Neis	2017-11-07	2023-02-24	75925535-ca97-4e0a-a850-00b5c00779dc
Splunk	Detects identities generating anomalously large model responses relative to their own historical baseline. (...)	Anomaly	stable	-	-	AWS	Privilege Escalation, Stealth Process Injection	-	medium	Rod Soto	2026-07-06	2026-07-06	a839a6f7-aaac-438b-9d99-be0b49481e17
Splunk	Detects identities invoking high-risk filesystem and execution tools via AWS Bedrock Claude. (...)	Anomaly	stable	-	-	AWS	Privilege Escalation, Stealth Process Injection	-	medium	Rod Soto	2026-07-06	2026-07-06	989b3702-1df3-4076-9e2f-8dcbcc2b4bef
Splunk	This detection identifies prompts with hostile or aggressive sentiment being sent to AWS Bedrock Claude models. (...)	Anomaly	stable	-	-	AWS	Privilege Escalation, Stealth Process Injection	-	medium	Rod Soto	2026-07-06	2026-07-06	54734442-955a-4427-9a86-2d9712151067
Splunk	This search surfaces AWS Bedrock Claude prompts containing phrases commonly associated with prompt injection or jailbreak attempts, such as instruction overrides, persona switching, or requests to ignore prior guidance. (...)	Hunting	stable	-	-	AWS	Privilege Escalation, Stealth Process Injection	-	medium	Rod Soto	2026-07-06	2026-07-06	9e162548-3e9a-4a74-9eb5-34ee28350f07
Splunk	This detection identifies sensitive data such as social security numbers, passwords, API keys, and credit card numbers being sent in prompts to AWS Bedrock Claude models. (...)	Anomaly	stable	-	-	AWS	Privilege Escalation, Stealth Process Injection	-	medium	Rod Soto	2026-07-06	2026-07-06	39346724-a73a-4e01-8e93-4f4791e1a0bb
Splunk	This detection identifies unusually large prompts sent to AWS Bedrock Claude models by calculating the statistical baseline of input token counts and flagging requests that exceed one standard deviations above the mean. (...)	Anomaly	stable	-	-	AWS	Privilege Escalation, Stealth Process Injection	-	medium	Rod Soto	2026-07-06	2026-07-08	95fbdd4e-1202-4971-b85a-513b2005086e
	Detects deletion of an Amazon Bedrock guardrail, which may indicate attempts to remove model safety (...)	Generic	experimental	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools	-	medium	Marco Pedrinazzi (@pedrinazziM) (InTheCyber)	2026-07-10	—	59b70e4d-dd17-44a9-b740-acf07ae3eb6a
	Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken model safety c (...)	Generic	experimental	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools	-	medium	Marco Pedrinazzi (@pedrinazziM) (InTheCyber)	2026-07-10	—	1c722651-254a-4b04-a9f4-99b62a2d0a1f
	Detects changes to the EC2 instance startup script. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Unix Shell	-	high	faloker	2020-02-12	2022-06-07	1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df
	An attempt to export an AWS EC2 instance has been detected. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Collection Data from Local System Exfiltration Transfer Data to Cloud Account	-	low	Diogo Braz	2020-04-16	2022-10-05	54b9a76a-3c71-4673-b4b3-2edb4566ea7b
	Detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an attacker trying to avoid detection of its malicious activities. (...)	Generic	experimental	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools Disable or Modify Cloud Log	-	high	suktech24	2025-11-27	—	d2656e78-c069-4571-8220-9e0ab5913f19
	Detects updates of the GuardDuty list of trusted IPs, perhaps to disable security alerts against malicious IPs.	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools	-	high	faloker	2020-02-11	2022-10-09	6e61ee20-ce00-4f8d-8aee-bedd8216f7e3
	Detects evade to Macie detection.	Unsupported	unsupported	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools	-	medium	Sittikorn S	2021-07-06	2023-03-24	91f6a16c-ef71-437a-99ac-0b070e3ad221
	Detects the modification of the findings on SecurityHub.	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools	-	high	Sittikorn S	2021-06-28	—	a607e1fe-74bf-4440-a3ec-b059b9103157
	Detects file creation events linked to the Axios NPM supply chain compromise. (...)	Emerging	experimental	file_event	linux	Sysmon	Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	b7cb840c-11f6-47f7-b3ef-5524739c9077
	Detects file creation events linked to the Axios NPM supply chain compromise on macOS devices. (...)	Emerging	experimental	file_event	macos	-	Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	2db0458c-05c9-4069-a26f-77becd9c8c13
	Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. (...)	Emerging	experimental	process_creation	linux	Sysmon	Execution Command and Scripting Interpreter Unix Shell Python Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	0a23a62d-c5b3-468b-a072-25064a9a8c87
	Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup.	Emerging	experimental	process_creation	macos	-	Execution Command and Scripting Interpreter AppleScript Unix Shell Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	a09ee860-31b3-4586-8a68-0ebd74ce0e5f
	Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. (...)	Emerging	experimental	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Visual Basic Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	f6c27ecc-d890-4452-80e6-2e274a10e097
Splunk	The following analytic detects when the risk-based step-up consent security setting in Azure AD is disabled. (...)	Generic	stable	account_management	-	Microsoft 365	Defense Impairment Disable or Modify Tools	-	medium	Mauricio Velazco, Splunk	2023-11-16	2026-05-13	875de3d7-09bc-4916-8c0a-0929f4ced3d8
	Detects when Events are deleted in Azure Kubernetes. (...)	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Defense Impairment Disable or Modify Tools	-	medium	Austin Songer @austinsonger	2021-07-24	2022-08-23	225d8b09-e714-479c-a0e4-55e6f29adf35

Title

Description

WarzoneRAT S0670

WarzoneRAT S0670

WarzoneRAT MITRE reference S0670

Standing S0670

Reach

Coverage

WarzoneRAT detections S0670